CVSS 3.0
5.3 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2017-8446
Medium (5.3) in elasticsearch. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in org.elasticsearch.plugin:x-pack 5.5.2.
The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-269, CWE-522
- Published
- Modified
- Record from
- the NVD, synced
Affected
- elasticsearch:x-pack
- elasticsearch:x-pack_reporting
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m728-qvxh-xfjq | Maven | org.elasticsearch.plugin:x-pack | <5.5.2 | 5.5.2 |